Revealing Training Data Exposure in Vision–Language Large Models via Parameter Gradients

As Vision-Language Large Models (VLLMs) are increasingly trained on massive, often copyrighted, web-crawled datasets, there is an urgent need to verify whether specific data were used during training. Existing auditing methods, which rely on output signals like loss or entropy, struggle with the cross-modal nature of VLLMs and often fail to distinguish between genuine learned associations and random chance. The authors ask: can we leverage internal optimization dynamics—specifically parameter gradients—to more accurately detect training data exposure?

GradAudit operates on the observation that during training, model parameters converge to regions where gradients for training samples become stable and well-aligned, while gradients for non-training samples remain noisy. Because gradients are shared across all model components (vision encoders, language models, and fusion modules), they provide a unified signal for multimodal data. To handle the scale of modern VLLMs, the authors decompose gradient matrices into functionally interpretable slices and apply a noise-masking mechanism to suppress insensitive features, focusing the audit on components that are most reactive to training data.

GradAudit consistently outperforms state-of-the-art baselines across seven experimental configurations, including both pre-training and fine-tuning scenarios. It achieves high AUROC scores (up to 92.7%) and demonstrates a unique ability to distinguish between correctly paired training data and shuffled pairs, confirming it captures true multimodal associations. In a case study using copyrighted Studio Ghibli content, GradAudit revealed that existing methods significantly underestimate unauthorized data usage, with this underestimation growing as models become more advanced and recent.